CompTIA Network+ (N10-009)Network OperationsHard
A network administrator wants visibility into traffic flow statistics but is deploying the monitoring tool on lower-cost switches that only support standardized sampling of packets at the interface level rather than full flow export from the routing engine. Which technology is being used?
- ANetFlow
- BPort mirroring
- CsFlow
- DSNMP polling
Show answer & explanationAnswer & explanation
Correct answer: C. sFlow
sFlow is a vendor-neutral, standards-based sampling technology that captures a statistical sample of packets at the interface level, making it lighter-weight and widely supported on lower-cost switches compared to Cisco's proprietary NetFlow, which typically exports complete flow records processed by the router's control plane.
Why the other options are wrong
- A. NetFlow is Cisco-originated and exports full flow records rather than sampled packets, often requiring more processing overhead.
- B. Port mirroring copies raw traffic to an analyzer port but does not itself provide flow statistics.
- D. SNMP polling retrieves counter/interface statistics, not detailed per-flow traffic data.
sFlow vs NetFlow
sFlow is an open, vendor-neutral standard that captures statistically sampled packets at the interface level, while NetFlow (Cisco-originated) exports complete flow records from the control plane.
- sFlow = packet sampling, lightweight, vendor-neutral
- NetFlow = full flow export, Cisco proprietary origin
- sFlow commonly found on lower-cost/multi-vendor switches
Memory trick: sFlow samples a slice; NetFlow captures the full flow.